Bump worker 1.26.1 cli@1.38.0 (#4843)

* bump CLI to 1.38.0

* bump local worker

* update test

* ci: skip phoenix_storybook advisories in deps.audit (#4846)

phoenix_storybook 0.9.2 has three open advisories (critical RCE, high
atom-table DoS, low PubSub injection). The dep is dev-only and excluded
from prod builds, so there is no production exposure. Skip the advisories
to unblock lint; removal is tracked in #4846.

---------

Co-authored-by: Stuart Corbishley <corbish@gmail.com>

Author: josephjclark

.circleci/config.yml

@@ -186,8 +186,13 @@ jobs:
           name: "Check for known-vulnerable Hex dependencies"
           when: always
           command: |
+            # GHSA-g2wm-735q-3f56: cowlib cookie encoder CRLF injection (low);
+            #   no patched release available yet.
+            # GHSA-55hg-8qxv-qj4p / GHSA-833p-95jq-929q / GHSA-mrhx-6pw9-q5fh:
+            #   phoenix_storybook advisories. Dev-only dep, not compiled into
+            #   prod and storybook routes are dev-only. Tracked for removal.
             sudo -u lightning mix deps.audit \
-              --ignore-advisory-ids GHSA-g2wm-735q-3f56 \
+              --ignore-advisory-ids GHSA-g2wm-735q-3f56,GHSA-55hg-8qxv-qj4p,GHSA-833p-95jq-929q,GHSA-mrhx-6pw9-q5fh \
               || echo "deps.audit" >> /tmp/lint_failed
       - run:
           name: "Check for retired Hex packages"

assets/package-lock.json

@@ -69,7 +69,7 @@
   "devDependencies": {
     "@eslint-community/eslint-plugin-eslint-comments": "^4.4.1",
     "@eslint/js": "^9.21.0",
-    "@openfn/ws-worker": "^1.25.0",
+    "@openfn/ws-worker": "^1.26.1",
     "@playwright/test": "^1.55.0",
     "@redux-devtools/extension": "^3.3.0",
     "@testing-library/jest-dom": "^6.9.0",

assets/package.json

@@ -11,7 +11,7 @@ defmodule Mix.Tasks.Lightning.InstallRuntime do
   use Mix.Task
 
   @default_path "priv/openfn"
-  @cli_version "1.36.3"
+  @cli_version "1.38.0"
 
   def run(args) do
     case Rambo.run("/usr/bin/env", ~w(which node)) do

lib/mix/tasks/install_runtime.ex

@@ -269,7 +269,7 @@ defmodule Lightning.WebAndWorkerTest do
 
       version_logs = pick_out_version_logs(run)
       assert version_logs["@openfn/language-http"] =~ "3.1.12"
-      assert version_logs["worker"] =~ "1.25"
+      assert version_logs["worker"] =~ "1.26"
       assert version_logs["node.js"] =~ "22.12"
       assert version_logs["@openfn/language-common"] == "3.0.2"